« Volver al listado

CVE-2022-21950

Estado: ModificadaMedia (5.3)—

A Improper Access Control vulnerability in the systemd service of cana in openSUSE Backports SLE-15-SP3, openSUSE Backports SLE-15-SP4 allows local users to hijack the UNIX domain socket This issue affects: openSUSE Backports SLE-15-SP3 canna versions prior to canna-3.7p3-bp153.2.3.1. openSUSE Backports SLE-15-SP4 canna versions prior to 3.7p3-bp154.3.3.1. openSUSE Factory was also affected. Instead of fixing the package it was deleted there.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Opensuse — Canna

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-21950",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "meissner@suse.de",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 1.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "meissner@suse.de",
      "affectedData": [
        {
          "vendor": "openSUSE",
          "product": "openSUSE Backports SLE-15-SP3",
          "versions": [
            {
              "status": "affected",
              "version": "canna",
              "lessThan": "canna-3.7p3-bp153.2.3.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "openSUSE",
          "product": "openSUSE Backports SLE-15-SP4",
          "versions": [
            {
              "status": "affected",
              "version": "canna",
              "lessThan": "3.7p3-bp154.3.3.1",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-09-07T09:15:08.670",
  "references": [
    {
      "url": "https://bugzilla.suse.com/show_bug.cgi?id=1199280",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "meissner@suse.de"
    },
    {
      "url": "https://bugzilla.suse.com/show_bug.cgi?id=1199280",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "meissner@suse.de",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A Improper Access Control vulnerability in the systemd service of cana in openSUSE Backports SLE-15-SP3, openSUSE Backports SLE-15-SP4 allows local users to hijack the UNIX domain socket This issue affects: openSUSE Backports SLE-15-SP3 canna versions prior to canna-3.7p3-bp153.2.3.1. openSUSE Backports SLE-15-SP4 canna versions prior to 3.7p3-bp154.3.3.1. openSUSE Factory was also affected. Instead of fixing the package it was deleted there."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de Control de Acceso inapropiado en el servicio systemd de cana en openSUSE Backports SLE-15-SP3, openSUSE Backports SLE-15-SP4 permite a usuarios locales secuestrar el socket de dominio UNIX Este problema afecta a: openSUSE Backports SLE-15-SP3 versiones de canna anteriores a canna-3.7p3-bp153.2.3.1. openSUSE Backports SLE-15-SP4 versiones de canna anteriores a 3.7p3-bp154.3.3.1. openSUSE Factory también está afectado. En lugar de arreglar el paquete fue eliminado allí"
    }
  ],
  "lastModified": "2026-06-17T04:27:20.470",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:opensuse:canna:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "627905AC-CD77-4169-B771-A681688BAA3A",
              "versionEndExcluding": "3.7p3-bp153.2.3.1"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:opensuse:backports_sle:15.0:sp3:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "4847454B-DCD3-4F32-833E-6E51A90F06E9"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:opensuse:canna:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "345554AF-5541-4D24-8FDB-1F0648F492FE",
              "versionEndExcluding": "3.7p3-bp154.3.3.1"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:opensuse:backports_sle:15.0:sp4:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "842598F5-31B5-42D2-930C-B405314217B1"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:opensuse:canna:3.7p3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C62B2B23-EA58-4EE8-B7AD-4FD074A64332"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:opensuse:factory:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "E29492E1-43D8-43BF-94E3-26A762A66FAA"
            },
            {
              "criteria": "cpe:2.3:o:suse:linux_enterprise:12.0:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "CBC8B78D-1131-4F21-919D-8AC79A410FB9"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "meissner@suse.de"
}